chore(deps): update dependency vite to v6.3.4 [security] - abandoned#62
chore(deps): update dependency vite to v6.3.4 [security] - abandoned#62renovate[bot] wants to merge 2 commits intomainfrom
Conversation
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Join our Discord community for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
commit: |
|
Deploy preview for mono-lib-boilerplate ready! ✅ Preview Built with commit 0491875. |
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
27b9598 to
1a183a3
Compare
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. |
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
0bf9fd3 to
0491875
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #62 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 1 1
Lines 2 2
=========================================
Hits 2 2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
renovate
bot
changed the title
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
This PR contains the following updates:
6.3.2->6.3.4GitHub Vulnerability Alerts
CVE-2025-46565
Summary
The contents of files in the project
rootthat are denied by a file matching pattern can be returned to the browser.Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project
rootand are denied by a file matching pattern can be bypassed..env,.env.*,*.{crt,pem},**/.env**/.git/**,.git/**,.git/**/*Details
server.fs.denycan contain patterns matching against files (by default it includes.env,.env.*,*.{crt,pem}as such patterns).These patterns were able to bypass for files under
rootby using a combination of slash and dot (/.).PoC
Release Notes
vitejs/vite (vite)
v6.3.4Compare Source
requireto import externals in optimized dependenci (efc5eab), closes #19940v6.3.3Compare Source
ssrTransformre-export deps and test stacktrace with first line (#19629) (9399cda), closes #19629Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.